The Download Manager WordPress plugin contains a DOM‑based reflected cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript through the REFERRER parameter. Because input is not properly sanitized and output is not escaped, the malicious script runs in the victim’s browser, enabling hijacking of the user’s session, theft of credentials, or unwanted actions performed on behalf of the user. The impact is confined to the client side, but the consequences could be serious if sensitive data is exposed or login tokens are stolen.

The affected product is the codename065 Download Manager plugin for WordPress. All releases up to and including version 3.3.57 are vulnerable. No specific sub‑versions are listed, so any build within that range is potentially impacted.

The vulnerability is scored 6.1 on the CVSS v3.1 scale, indicating moderate severity. EPSS data is unavailable, and it is not listed in the CISA KEV catalog. Unauthenticated users can trigger the flaw by forging a request that sets the REFERRER header to a malicious value; the attack vector is purely web‑based, exploiting the client‑side rendering of the page.